CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Rescana reports that on 2 October 2026, CISA described CVE-2026-102490 as an improper privilege management flaw that CISA says can let the local zammad user escalate to root[1]. Rescana says CISA set a federal due date of 5 October 2026[1]. HOL describes the two as session fixation that can reach remote code execution as the zammad user, then local privilege escalation from that user to root[2].HOL reports that DIVD published the CVEs under case DIVD-2026-00015 after investigating its own network breach[2]. According to Rescana, DIVD describes the intrusion as an agentic-AI-driven attack[1].Rescana reports that NVD scores each at CVSS 3.1 9.8 Critical[1]. HOL says DIVD gives CVE-2026-102490 CVSS 4.0 base 8.5 High (critical sibling vector 9.4)[2]. HOL also says DIVD lists affected versions from 1.5.0 before 7.1.0-alpha[2].According to Rescana, Zammad GmbH has publicly disagreed with DIVD on affected versions, on exploitability of CVE-2026-102490 on its own, and on how the disclosure was handled[1].In its advisory, Zammad says details of the flaw were made public before we received the technical details necessary to reproduce and evaluate the issue[3]. The company adds that it is addressing the issue as a high priority[3].HOL advises admins to keep the Zammad UI off the public internet until you are on 7.2.0[2].